eventlog.h File Reference

#include <stdarg.h>
#include <windef.h>
#include <winbase.h>
#include <ndk/rtlfuncs.h>
#include <ndk/obfuncs.h>
#include <evtlib.h>
#include <eventlogrpc_s.h>
#include <strsafe.h>

Include dependency graph for eventlog.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Classes
struct	_LOGFILE
struct	_EVENTSOURCE
struct	_LOGHANDLE

Macros
#define	WIN32_NO_STATUS
#define	NTOS_MODE_USER
#define	ROUND_DOWN(n, align)   (((ULONG)n) & ~((align) - 1l))
#define	ROUND_UP(n, align)   ROUND_DOWN(((ULONG)n) + (align) - 1, (align))
#define	LOG_HANDLE_BACKUP_FILE   1

Typedefs
typedef struct _LOGFILE	LOGFILE
typedef struct _LOGFILE *	PLOGFILE
typedef struct _EVENTSOURCE	EVENTSOURCE
typedef struct _EVENTSOURCE *	PEVENTSOURCE
typedef struct _LOGHANDLE	LOGHANDLE
typedef struct _LOGHANDLE *	PLOGHANDLE

Functions
VOID	PRINT_RECORD (PEVENTLOGRECORD pRec)
VOID	InitEventSourceList (VOID)
BOOL	LoadEventSources (HKEY hKey, PLOGFILE pLogFile)
PEVENTSOURCE	GetEventSourceByName (LPCWSTR Name)
VOID	LogfListInitialize (VOID)
DWORD	LogfListItemCount (VOID)
PLOGFILE	LogfListItemByIndex (DWORD Index)
PLOGFILE	LogfListItemByName (LPCWSTR Name)
NTSTATUS	LogfCreate (PLOGFILE *LogFile, PCWSTR LogName, PUNICODE_STRING FileName, ULONG MaxSize, ULONG Retention, BOOLEAN Permanent, BOOLEAN Backup)
VOID	LogfClose (PLOGFILE LogFile, BOOLEAN ForceClose)
VOID	LogfCloseAll (VOID)
NTSTATUS	LogfClearFile (PLOGFILE LogFile, PUNICODE_STRING BackupFileName)
NTSTATUS	LogfBackupFile (PLOGFILE LogFile, PUNICODE_STRING BackupFileName)
NTSTATUS	LogfReadEvents (PLOGFILE LogFile, ULONG Flags, PULONG RecordNumber, ULONG BufSize, PBYTE Buffer, PULONG BytesRead, PULONG BytesNeeded, BOOLEAN Ansi)
NTSTATUS	LogfWriteRecord (PLOGFILE LogFile, PEVENTLOGRECORD Record, SIZE_T BufSize)
PEVENTLOGRECORD	LogfAllocAndBuildNewRecord (PSIZE_T pRecSize, ULONG Time, USHORT wType, USHORT wCategory, ULONG dwEventId, PUNICODE_STRING SourceName, PUNICODE_STRING ComputerName, ULONG dwSidLength, PSID pUserSid, USHORT wNumStrings, PWSTR pStrings, ULONG dwDataSize, PVOID pRawData)
static __inline void	LogfFreeRecord (PEVENTLOGRECORD Record)
VOID	LogfReportEvent (USHORT wType, USHORT wCategory, ULONG dwEventId, USHORT wNumStrings, PWSTR pStrings, ULONG dwDataSize, PVOID pRawData)
NTSTATUS WINAPI	PortThreadRoutine (PVOID Param)
NTSTATUS	InitLogPort (VOID)
NTSTATUS	ProcessPortMessage (VOID)
DWORD WINAPI	RpcThreadRoutine (LPVOID lpParameter)

Variables
PEVENTSOURCE	EventLogSource

Macro Definition Documentation

LOG_HANDLE_BACKUP_FILE

#define LOG_HANDLE_BACKUP_FILE   1

Definition at line 53 of file eventlog.h.

NTOS_MODE_USER

#define NTOS_MODE_USER

Definition at line 19 of file eventlog.h.

ROUND_DOWN

#define ROUND_DOWN	(		n,
			align
	)		(((ULONG)n) & ~((align) - 1l))

Definition at line 23 of file eventlog.h.

ROUND_UP

#define ROUND_UP	(		n,
			align
	)		ROUND_DOWN(((ULONG)n) + (align) - 1, (align))

Definition at line 24 of file eventlog.h.

WIN32_NO_STATUS

#define WIN32_NO_STATUS

Definition at line 15 of file eventlog.h.

Typedef Documentation

EVENTSOURCE

typedef struct _EVENTSOURCE EVENTSOURCE

LOGFILE

typedef struct _LOGFILE LOGFILE

LOGHANDLE

typedef struct _LOGHANDLE LOGHANDLE

PEVENTSOURCE

typedef struct _EVENTSOURCE * PEVENTSOURCE

PLOGFILE

typedef struct _LOGFILE * PLOGFILE

PLOGHANDLE

typedef struct _LOGHANDLE * PLOGHANDLE

Function Documentation

GetEventSourceByName()

PEVENTSOURCE GetEventSourceByName

(

LPCWSTR

Name

)

Definition at line 202 of file eventsource.c.

{
    PLIST_ENTRY CurrentEntry;
    PEVENTSOURCE Item, Result = NULL;
 
    DPRINT("GetEventSourceByName(%S)\n", Name);
    EnterCriticalSection(&EventSourceListCs);
 
    CurrentEntry = EventSourceListHead.Flink;
    while (CurrentEntry != &EventSourceListHead)
    {
        Item = CONTAINING_RECORD(CurrentEntry,
                                 EVENTSOURCE,
                                 EventSourceListEntry);
 
        DPRINT("Item->szName: %S\n", Item->szName);
//        if ((*(Item->szName) != 0) && !_wcsicmp(Item->szName, Name))
        if (_wcsicmp(Item->szName, Name) == 0)
        {
            DPRINT("Found it\n");
            Result = Item;
            break;
        }
 
        CurrentEntry = CurrentEntry->Flink;
    }
 
    LeaveCriticalSection(&EventSourceListCs);
 
    DPRINT("Done (Result: %p)\n", Result);
 
    return Result;
}

Referenced by ElfCreateEventLogHandle(), and wmain().

InitEventSourceList()

VOID InitEventSourceList

(

VOID

)

Definition at line 22 of file eventsource.c.

{
    InitializeCriticalSection(&EventSourceListCs);
    InitializeListHead(&EventSourceListHead);
}

Referenced by wmain().

InitLogPort()

NTSTATUS InitLogPort

(

VOID

)

Definition at line 47 of file logport.c.

{
    NTSTATUS Status;
    UNICODE_STRING PortName = RTL_CONSTANT_STRING(ELF_PORT_NAME);
    OBJECT_ATTRIBUTES ObjectAttributes;
    PORT_MESSAGE Request;
 
    ConnectPortHandle = NULL;
    MessagePortHandle = NULL;
 
    InitializeObjectAttributes(&ObjectAttributes, &PortName, 0, NULL, NULL);
 
    Status = NtCreatePort(&ConnectPortHandle,
                          &ObjectAttributes,
                          0,
                          PORT_MAXIMUM_MESSAGE_LENGTH, // IO_ERROR_LOG_MESSAGE_LENGTH,
                          2 * PAGE_SIZE);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("NtCreatePort() failed (Status %lx)\n", Status);
        goto ByeBye;
    }
 
    Status = NtListenPort(ConnectPortHandle, &Request);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("NtListenPort() failed (Status %lx)\n", Status);
        goto ByeBye;
    }
 
    Status = NtAcceptConnectPort(&MessagePortHandle, ConnectPortHandle,
                                 &Request, TRUE, NULL, NULL);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("NtAcceptConnectPort() failed (Status %lx)\n", Status);
        goto ByeBye;
    }
 
    Status = NtCompleteConnectPort(MessagePortHandle);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("NtCompleteConnectPort() failed (Status %lx)\n", Status);
        goto ByeBye;
    }
 
ByeBye:
    if (!NT_SUCCESS(Status))
    {
        if (ConnectPortHandle != NULL)
            NtClose(ConnectPortHandle);
 
        if (MessagePortHandle != NULL)
            NtClose(MessagePortHandle);
    }
    return Status;
}

Referenced by PortThreadRoutine().

LoadEventSources()

BOOL LoadEventSources	(	HKEY	hKey,
		PLOGFILE	pLogFile
	)

Definition at line 82 of file eventsource.c.

{
    BOOL Success;
    DWORD dwNumSubKeys, dwMaxSubKeyLength;
    DWORD dwEventSourceNameLength, MaxValueLen;
    DWORD dwIndex;
    PWSTR Buf = NULL, SourceList = NULL, Source = NULL;
    size_t cchRemaining = 0;
    LONG Result;
 
    DPRINT("LoadEventSources\n");
 
    Result = RegQueryInfoKeyW(hKey, NULL, NULL, NULL, &dwNumSubKeys, &dwMaxSubKeyLength,
                              NULL, NULL, NULL, NULL, NULL, NULL);
    if (Result != ERROR_SUCCESS)
    {
        DPRINT1("RegQueryInfoKeyW failed: %lu\n", Result);
        return FALSE;
    }
 
    dwMaxSubKeyLength++;
 
    Buf = HeapAlloc(GetProcessHeap(), 0, dwMaxSubKeyLength * sizeof(WCHAR));
    if (!Buf)
    {
        DPRINT1("Error: cannot allocate heap!\n");
        return FALSE;
    }
 
    /*
     * Allocate a buffer for storing the names of the sources as a REG_MULTI_SZ
     * in the registry. Also add the event log as its own source.
     * Add a final NULL-terminator.
     */
    MaxValueLen = dwNumSubKeys * dwMaxSubKeyLength + wcslen(pLogFile->LogName) + 2;
    SourceList = HeapAlloc(GetProcessHeap(), 0, MaxValueLen * sizeof(WCHAR));
    if (!SourceList)
    {
        DPRINT1("Error: cannot allocate heap!\n");
        /* It is not dramatic if we cannot create it */
    }
    else
    {
        cchRemaining = MaxValueLen;
        Source = SourceList;
    }
 
    /*
     * Enumerate all the subkeys of the event log key, that constitute
     * all the possible event sources for this event log. At this point,
     * skip the possible existing source having the same name as the
     * event log, it will be added later on.
     */
    dwEventSourceNameLength = dwMaxSubKeyLength;
    dwIndex = 0;
    while (RegEnumKeyExW(hKey,
                         dwIndex,
                         Buf,
                         &dwEventSourceNameLength,
                         NULL, NULL, NULL, NULL) == ERROR_SUCCESS)
    {
        if (_wcsicmp(pLogFile->LogName, Buf) != 0)
        {
            DPRINT("Event Source: %S\n", Buf);
            Success = AddNewEventSource(pLogFile, Buf);
            if (Success && (Source != NULL))
            {
                /* Append the event source name and an extra NULL-terminator */
                StringCchCopyExW(Source, cchRemaining, Buf, &Source, &cchRemaining, 0);
                if (cchRemaining > 0)
                {
                    *++Source = L'\0';
                    cchRemaining--;
                }
            }
        }
 
        dwEventSourceNameLength = dwMaxSubKeyLength;
        dwIndex++;
    }
 
    /* Finally, allow the event log itself to be its own source */
    DPRINT("Event Source: %S\n", pLogFile->LogName);
    Success = AddNewEventSource(pLogFile, pLogFile->LogName);
    if (Success && (Source != NULL))
    {
        /* Append the event source name and an extra NULL-terminator */
        StringCchCopyExW(Source, cchRemaining, pLogFile->LogName, &Source, &cchRemaining, 0);
        if (cchRemaining > 0)
        {
            *++Source = L'\0';
            cchRemaining--;
        }
    }
 
    /* Save the list of sources in the registry */
    Result = RegSetValueExW(hKey,
                            L"Sources",
                            0,
                            REG_MULTI_SZ,
                            (LPBYTE)SourceList,
                            (MaxValueLen - cchRemaining + 1) * sizeof(WCHAR));
    if (Result != ERROR_SUCCESS)
    {
        DPRINT1("RegSetValueExW failed: %lu\n", Result);
    }
 
    if (SourceList)
        HeapFree(GetProcessHeap(), 0, SourceList);
 
    HeapFree(GetProcessHeap(), 0, Buf);
 
    DumpEventSourceList();
 
    return TRUE;
}

Referenced by LoadLogFiles().

LogfAllocAndBuildNewRecord()

PEVENTLOGRECORD LogfAllocAndBuildNewRecord	(	PSIZE_T	pRecSize,
		ULONG	Time,
		USHORT	wType,
		USHORT	wCategory,
		ULONG	dwEventId,
		PUNICODE_STRING	SourceName,
		PUNICODE_STRING	ComputerName,
		ULONG	dwSidLength,
		PSID	pUserSid,
		USHORT	wNumStrings,
		PWSTR	pStrings,
		ULONG	dwDataSize,
		PVOID	pRawData
	)

Definition at line 896 of file file.c.

{
    SIZE_T RecSize;
    SIZE_T SourceNameSize, ComputerNameSize, StringLen;
    PBYTE Buffer;
    PEVENTLOGRECORD pRec;
    PWSTR str;
    UINT i, pos;
 
    SourceNameSize   = (SourceName   && SourceName->Buffer)   ? SourceName->Length   : 0;
    ComputerNameSize = (ComputerName && ComputerName->Buffer) ? ComputerName->Length : 0;
 
    RecSize = sizeof(EVENTLOGRECORD) + /* Add the sizes of the strings, NULL-terminated */
        SourceNameSize + ComputerNameSize + 2*sizeof(UNICODE_NULL);
 
    /* Align on DWORD boundary for the SID */
    RecSize = ROUND_UP(RecSize, sizeof(ULONG));
 
    RecSize += dwSidLength;
 
    /* Add the sizes for the strings array */
    ASSERT((pStrings == NULL && wNumStrings == 0) ||
           (pStrings != NULL && wNumStrings >= 0));
    for (i = 0, str = pStrings; i < wNumStrings; i++)
    {
        StringLen = wcslen(str) + 1; // str must be != NULL
        RecSize += StringLen * sizeof(WCHAR);
        str += StringLen;
    }
 
    /* Add the data size */
    RecSize += dwDataSize;
 
    /* Align on DWORD boundary for the full structure */
    RecSize = ROUND_UP(RecSize, sizeof(ULONG));
 
    /* Size of the trailing 'Length' member */
    RecSize += sizeof(ULONG);
 
    Buffer = RtlAllocateHeap(GetProcessHeap(), HEAP_ZERO_MEMORY, RecSize);
    if (!Buffer)
    {
        DPRINT1("Cannot allocate heap!\n");
        return NULL;
    }
 
    pRec = (PEVENTLOGRECORD)Buffer;
    pRec->Length = RecSize;
    pRec->Reserved = LOGFILE_SIGNATURE;
 
    /*
     * Do not assign here any precomputed record number to the event record.
     * The true record number will be assigned atomically and sequentially in
     * LogfWriteRecord, so that all the event records will have consistent and
     * unique record numbers.
     */
    pRec->RecordNumber = 0;
 
    /*
     * Set the generated time, and temporarily set the written time
     * with the generated time.
     */
    pRec->TimeGenerated = Time;
    pRec->TimeWritten   = Time;
 
    pRec->EventID = dwEventId;
    pRec->EventType = wType;
    pRec->EventCategory = wCategory;
 
    pos = sizeof(EVENTLOGRECORD);
 
    /* NOTE: Equivalents of RtlStringCbCopyUnicodeString calls */
    if (SourceNameSize)
    {
        StringCbCopyNW((PWSTR)(Buffer + pos), SourceNameSize + sizeof(UNICODE_NULL),
                       SourceName->Buffer, SourceNameSize);
    }
    pos += SourceNameSize + sizeof(UNICODE_NULL);
    if (ComputerNameSize)
    {
        StringCbCopyNW((PWSTR)(Buffer + pos), ComputerNameSize + sizeof(UNICODE_NULL),
                       ComputerName->Buffer, ComputerNameSize);
    }
    pos += ComputerNameSize + sizeof(UNICODE_NULL);
 
    /* Align on DWORD boundary for the SID */
    pos = ROUND_UP(pos, sizeof(ULONG));
 
    pRec->UserSidLength = 0;
    pRec->UserSidOffset = 0;
    if (dwSidLength)
    {
        RtlCopyMemory(Buffer + pos, pUserSid, dwSidLength);
        pRec->UserSidLength = dwSidLength;
        pRec->UserSidOffset = pos;
        pos += dwSidLength;
    }
 
    pRec->StringOffset = pos;
    for (i = 0, str = pStrings; i < wNumStrings; i++)
    {
        StringLen = wcslen(str) + 1; // str must be != NULL
        StringCchCopyW((PWSTR)(Buffer + pos), StringLen, str);
        str += StringLen;
        pos += StringLen * sizeof(WCHAR);
    }
    pRec->NumStrings = wNumStrings;
 
    pRec->DataLength = 0;
    pRec->DataOffset = 0;
    if (dwDataSize)
    {
        RtlCopyMemory(Buffer + pos, pRawData, dwDataSize);
        pRec->DataLength = dwDataSize;
        pRec->DataOffset = pos;
        pos += dwDataSize;
    }
 
    /* Align on DWORD boundary for the full structure */
    pos = ROUND_UP(pos, sizeof(ULONG));
 
    /* Initialize the trailing 'Length' member */
    *((PDWORD)(Buffer + pos)) = RecSize;
 
    *pRecSize = RecSize;
    return pRec;
}

Referenced by ElfrIntReportEventW(), LogfReportEvent(), and ProcessPortMessage().

LogfBackupFile()

NTSTATUS LogfBackupFile	(	PLOGFILE	LogFile,
		PUNICODE_STRING	BackupFileName
	)

Definition at line 499 of file file.c.

{
    NTSTATUS Status;
    LOGFILE BackupLogFile;
    OBJECT_ATTRIBUTES ObjectAttributes;
    IO_STATUS_BLOCK IoStatusBlock;
 
    DPRINT("LogfBackupFile(%p, %wZ)\n", LogFile, BackupFileName);
 
    /* Lock the log file shared */
    RtlAcquireResourceShared(&LogFile->Lock, TRUE);
 
    InitializeObjectAttributes(&ObjectAttributes,
                               BackupFileName,
                               OBJ_CASE_INSENSITIVE,
                               NULL,
                               NULL);
 
    Status = NtCreateFile(&BackupLogFile.FileHandle,
                          GENERIC_READ | GENERIC_WRITE | SYNCHRONIZE,
                          &ObjectAttributes,
                          &IoStatusBlock,
                          NULL,
                          FILE_ATTRIBUTE_NORMAL,
                          FILE_SHARE_READ,
                          FILE_CREATE,
                          FILE_WRITE_THROUGH | FILE_SYNCHRONOUS_IO_NONALERT,
                          NULL,
                          0);
    if (!NT_SUCCESS(Status))
    {
        DPRINT("Cannot create backup file `%wZ' (Status 0x%08lx)\n", BackupFileName, Status);
        goto Quit;
    }
 
    Status = ElfBackupFile(&LogFile->LogFile,
                           &BackupLogFile.LogFile);
 
Quit:
    /* Close the backup file */
    if (BackupLogFile.FileHandle != NULL)
        NtClose(BackupLogFile.FileHandle);
 
    /* Unlock the log file */
    RtlReleaseResource(&LogFile->Lock);
 
    return Status;
}

Referenced by ElfrBackupELFW(), and LogfClearFile().

LogfClearFile()

NTSTATUS LogfClearFile	(	PLOGFILE	LogFile,
		PUNICODE_STRING	BackupFileName
	)

Definition at line 467 of file file.c.

{
    NTSTATUS Status;
 
    /* Lock the log file exclusive */
    RtlAcquireResourceExclusive(&LogFile->Lock, TRUE);
 
    if (BackupFileName->Length > 0)
    {
        /* Write a backup file */
        Status = LogfBackupFile(LogFile, BackupFileName);
        if (!NT_SUCCESS(Status))
        {
            DPRINT1("LogfBackupFile failed (Status 0x%08lx)\n", Status);
            goto Quit;
        }
    }
 
    Status = ElfReCreateFile(&LogFile->LogFile);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("LogfInitializeNew failed (Status 0x%08lx)\n", Status);
    }
 
Quit:
    /* Unlock the log file */
    RtlReleaseResource(&LogFile->Lock);
    return Status;
}

Referenced by ElfrClearELFW().

LogfClose()

VOID LogfClose	(	PLOGFILE	LogFile,
		BOOLEAN	ForceClose
	)

Definition at line 428 of file file.c.

{
    if (LogFile == NULL)
        return;
 
    if (!ForceClose && LogFile->Permanent)
        return;
 
    RtlAcquireResourceExclusive(&LogFile->Lock, TRUE);
 
    LogfListRemoveItem(LogFile);
 
    ElfCloseFile(&LogFile->LogFile);
    NtClose(LogFile->FileHandle);
    LogfpFree(LogFile->LogName, 0, 0);
 
    RtlDeleteResource(&LogFile->Lock);
 
    LogfpFree(LogFile, 0, TAG_ELF);
 
    return;
}

Referenced by ElfDeleteEventLogHandle(), and LogfCloseAll().

LogfCloseAll()

VOID LogfCloseAll

(

VOID

)

Definition at line 452 of file file.c.

{
    EnterCriticalSection(&LogFileListCs);
 
    while (!IsListEmpty(&LogFileListHead))
    {
        LogfClose(CONTAINING_RECORD(LogFileListHead.Flink, LOGFILE, ListEntry), TRUE);
    }
 
    LeaveCriticalSection(&LogFileListCs);
 
    DeleteCriticalSection(&LogFileListCs);
}

Referenced by wmain().

LogfCreate()

NTSTATUS LogfCreate	(	PLOGFILE *	LogFile,
		PCWSTR	LogName,
		PUNICODE_STRING	FileName,
		ULONG	MaxSize,
		ULONG	Retention,
		BOOLEAN	Permanent,
		BOOLEAN	Backup
	)

Definition at line 294 of file file.c.

{
    NTSTATUS Status;
    OBJECT_ATTRIBUTES ObjectAttributes;
    IO_STATUS_BLOCK IoStatusBlock;
    FILE_STANDARD_INFORMATION FileStdInfo;
    PLOGFILE pLogFile;
    SIZE_T LogNameLen;
    BOOLEAN CreateNew;
 
    pLogFile = LogfpAlloc(sizeof(*pLogFile), HEAP_ZERO_MEMORY, TAG_ELF);
    if (!pLogFile)
    {
        DPRINT1("Cannot allocate heap!\n");
        return STATUS_NO_MEMORY;
    }
 
    LogNameLen = (LogName ? wcslen(LogName) : 0) + 1;
    pLogFile->LogName = LogfpAlloc(LogNameLen * sizeof(WCHAR), HEAP_ZERO_MEMORY, 0);
    if (pLogFile->LogName == NULL)
    {
        DPRINT1("Cannot allocate heap\n");
        Status = STATUS_NO_MEMORY;
        goto Quit;
    }
 
    if (LogName)
        StringCchCopyW(pLogFile->LogName, LogNameLen, LogName);
 
    InitializeObjectAttributes(&ObjectAttributes,
                               FileName,
                               OBJ_CASE_INSENSITIVE,
                               NULL,
                               NULL);
 
    DPRINT("Going to create or open %wZ\n", FileName);
    Status = NtCreateFile(&pLogFile->FileHandle,
                          Backup ? (GENERIC_READ | SYNCHRONIZE)
                                 : (GENERIC_READ | GENERIC_WRITE | SYNCHRONIZE),
                          &ObjectAttributes,
                          &IoStatusBlock,
                          NULL,
                          FILE_ATTRIBUTE_NORMAL,
                          FILE_SHARE_READ,
                          Backup ? FILE_OPEN : FILE_OPEN_IF,
                          FILE_SYNCHRONOUS_IO_NONALERT,
                          NULL,
                          0);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("Cannot create file `%wZ' (Status 0x%08lx)\n", FileName, Status);
        goto Quit;
    }
 
    CreateNew = (IoStatusBlock.Information == FILE_CREATED);
    DPRINT("%wZ %s successfully\n", FileName, CreateNew ? "created" : "opened");
 
    /*
     * Retrieve the log file size and check whether the file is not too large;
     * this log format only supports files of theoretical size < 0xFFFFFFFF .
     *
     * As it happens that, on Windows (and ReactOS), retrieving the End-Of-File
     * information using NtQueryInformationFile with the FileEndOfFileInformation
     * class is invalid (who knows why...), use instead the FileStandardInformation
     * class, and the EndOfFile member of the returned FILE_STANDARD_INFORMATION
     * structure will give the desired information.
     */
    Status = NtQueryInformationFile(pLogFile->FileHandle,
                                    &IoStatusBlock,
                                    &FileStdInfo,
                                    sizeof(FileStdInfo),
                                    FileStandardInformation);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("EventLog: NtQueryInformationFile failed (Status 0x%08lx)\n", Status);
        goto Quit;
    }
    if (FileStdInfo.EndOfFile.HighPart != 0)
    {
        DPRINT1("EventLog: Log `%wZ' is too large.\n", FileName);
        Status = STATUS_EVENTLOG_FILE_CORRUPT; // STATUS_FILE_TOO_LARGE;
        goto Quit;
    }
 
    DPRINT("Initializing LogFile `%S'\n", pLogFile->LogName);
 
    Status = ElfCreateFile(&pLogFile->LogFile,
                           FileName,
                           FileStdInfo.EndOfFile.LowPart,
                           MaxSize,
                           Retention,
                           CreateNew,
                           Backup,
                           LogfpAlloc,
                           LogfpFree,
                           LogfpSetFileSize,
                           LogfpWriteFile,
                           LogfpReadFile,
                           LogfpFlushFile);
    if (!NT_SUCCESS(Status))
        goto Quit;
 
    pLogFile->Permanent = Permanent;
 
    RtlInitializeResource(&pLogFile->Lock);
 
    LogfListAddItem(pLogFile);
 
Quit:
    if (!NT_SUCCESS(Status))
    {
        if (pLogFile->FileHandle != NULL)
            NtClose(pLogFile->FileHandle);
 
        if (pLogFile->LogName)
            LogfpFree(pLogFile->LogName, 0, 0);
 
        LogfpFree(pLogFile, 0, TAG_ELF);
    }
    else
    {
        *LogFile = pLogFile;
    }
 
    return Status;
}

Referenced by ElfCreateBackupLogHandle(), and LoadLogFile().

LogfFreeRecord()

static __inline void LogfFreeRecord ( PEVENTLOGRECORD  Record )

static

Definition at line 143 of file eventlog.h.

{
    RtlFreeHeap(GetProcessHeap(), 0, Record);
}

Referenced by ElfrIntReportEventW(), LogfReportEvent(), and ProcessPortMessage().

LogfListInitialize()

VOID LogfListInitialize

(

VOID

)

Definition at line 27 of file file.c.

{
    InitializeCriticalSection(&LogFileListCs);
    InitializeListHead(&LogFileListHead);
}

Referenced by wmain().

LogfListItemByIndex()

PLOGFILE LogfListItemByIndex

(

DWORD

Index

)

Definition at line 93 of file file.c.

{
    PLIST_ENTRY CurrentEntry;
    PLOGFILE Result = NULL;
    DWORD i = 1;
 
    EnterCriticalSection(&LogFileListCs);
 
    CurrentEntry = LogFileListHead.Flink;
    while (CurrentEntry != &LogFileListHead)
    {
        if (i == Index)
        {
            Result = CONTAINING_RECORD(CurrentEntry, LOGFILE, ListEntry);
            break;
        }
 
        CurrentEntry = CurrentEntry->Flink;
        i++;
    }
 
    LeaveCriticalSection(&LogFileListCs);
    return Result;
}

Referenced by ElfCreateEventLogHandle().

LogfListItemByName()

PLOGFILE LogfListItemByName

(

LPCWSTR

Name

)

Definition at line 33 of file file.c.

{
    PLIST_ENTRY CurrentEntry;
    PLOGFILE Item, Result = NULL;
 
    ASSERT(Name);
 
    EnterCriticalSection(&LogFileListCs);
 
    CurrentEntry = LogFileListHead.Flink;
    while (CurrentEntry != &LogFileListHead)
    {
        Item = CONTAINING_RECORD(CurrentEntry, LOGFILE, ListEntry);
 
        if (Item->LogName && !_wcsicmp(Item->LogName, Name))
        {
            Result = Item;
            break;
        }
 
        CurrentEntry = CurrentEntry->Flink;
    }
 
    LeaveCriticalSection(&LogFileListCs);
    return Result;
}

Referenced by ElfCreateEventLogHandle(), and ProcessPortMessage().

LogfListItemCount()

DWORD LogfListItemCount

(

VOID

)

Definition at line 118 of file file.c.

{
    PLIST_ENTRY CurrentEntry;
    DWORD i = 0;
 
    EnterCriticalSection(&LogFileListCs);
 
    CurrentEntry = LogFileListHead.Flink;
    while (CurrentEntry != &LogFileListHead)
    {
        CurrentEntry = CurrentEntry->Flink;
        i++;
    }
 
    LeaveCriticalSection(&LogFileListCs);
    return i;
}

Referenced by ElfCreateEventLogHandle().

LogfReadEvents()

NTSTATUS LogfReadEvents	(	PLOGFILE	LogFile,
		ULONG	Flags,
		PULONG	RecordNumber,
		ULONG	BufSize,
		PBYTE	Buffer,
		PULONG	BytesRead,
		PULONG	BytesNeeded,
		BOOLEAN	Ansi
	)

Definition at line 721 of file file.c.

{
    NTSTATUS Status;
    ULONG RecNum;
    SIZE_T ReadLength, NeededSize;
    ULONG BufferUsage;
 
    /* Parameters validation */
 
    /* EVENTLOG_SEQUENTIAL_READ and EVENTLOG_SEEK_READ are mutually exclusive */
    if ((Flags & EVENTLOG_SEQUENTIAL_READ) && (Flags & EVENTLOG_SEEK_READ))
        return STATUS_INVALID_PARAMETER;
 
    if (!(Flags & EVENTLOG_SEQUENTIAL_READ) && !(Flags & EVENTLOG_SEEK_READ))
        return STATUS_INVALID_PARAMETER;
 
    /* EVENTLOG_FORWARDS_READ and EVENTLOG_BACKWARDS_READ are mutually exclusive */
    if ((Flags & EVENTLOG_FORWARDS_READ) && (Flags & EVENTLOG_BACKWARDS_READ))
        return STATUS_INVALID_PARAMETER;
 
    if (!(Flags & EVENTLOG_FORWARDS_READ) && !(Flags & EVENTLOG_BACKWARDS_READ))
        return STATUS_INVALID_PARAMETER;
 
    if (!Buffer || !BytesRead || !BytesNeeded)
        return STATUS_INVALID_PARAMETER;
 
    /* In seek read mode, a record number of 0 is invalid */
    if (!(Flags & EVENTLOG_SEQUENTIAL_READ) && (*RecordNumber == 0))
        return STATUS_INVALID_PARAMETER;
 
    /* Lock the log file shared */
    RtlAcquireResourceShared(&LogFile->Lock, TRUE);
 
    /*
     * In sequential read mode, a record number of 0 means we need
     * to determine where to start the read operation. Otherwise
     * we just use the provided record number.
     */
    if ((Flags & EVENTLOG_SEQUENTIAL_READ) && (*RecordNumber == 0))
    {
        if (Flags & EVENTLOG_FORWARDS_READ)
        {
            *RecordNumber = ElfGetOldestRecord(&LogFile->LogFile);
        }
        else // if (Flags & EVENTLOG_BACKWARDS_READ)
        {
            *RecordNumber = ElfGetCurrentRecord(&LogFile->LogFile) - 1;
        }
    }
 
    RecNum = *RecordNumber;
 
    *BytesRead = 0;
    *BytesNeeded = 0;
 
    BufferUsage = 0;
    do
    {
        Status = ReadRecord(&LogFile->LogFile,
                            RecNum,
                            (PEVENTLOGRECORD)(Buffer + BufferUsage),
                            BufSize - BufferUsage,
                            &ReadLength,
                            &NeededSize,
                            Ansi);
        if (Status == STATUS_NOT_FOUND)
        {
            if (BufferUsage == 0)
            {
                Status = STATUS_END_OF_FILE;
                goto Quit;
            }
            else
            {
                break;
            }
        }
        else
        if (Status == STATUS_BUFFER_TOO_SMALL)
        {
            if (BufferUsage == 0)
            {
                *BytesNeeded = NeededSize;
                // Status = STATUS_BUFFER_TOO_SMALL;
                goto Quit;
            }
            else
            {
                break;
            }
        }
        else
        if (!NT_SUCCESS(Status))
        {
            DPRINT1("ElfReadRecord failed (Status 0x%08lx)\n", Status);
            goto Quit;
        }
 
        /* Go to the next event record */
        /*
         * NOTE: This implicitly supposes that all the other record numbers
         * are consecutive (and do not jump than more than one unit); but if
         * it is not the case, then we would prefer here to call some
         * "get_next_record_number" function.
         */
        if (Flags & EVENTLOG_FORWARDS_READ)
            RecNum++;
        else // if (Flags & EVENTLOG_BACKWARDS_READ)
            RecNum--;
 
        BufferUsage += ReadLength;
    }
    while (BufferUsage <= BufSize);
 
    *BytesRead = BufferUsage;
    *RecordNumber = RecNum;
 
    Status = STATUS_SUCCESS;
 
Quit:
    /* Unlock the log file */
    RtlReleaseResource(&LogFile->Lock);
 
    if (!NT_SUCCESS(Status))
        DPRINT1("LogfReadEvents failed (Status 0x%08lx)\n", Status);
 
    return Status;
}

Referenced by ElfrReadELA(), and ElfrReadELW().

LogfReportEvent()

VOID LogfReportEvent	(	USHORT	wType,
		USHORT	wCategory,
		ULONG	dwEventId,
		USHORT	wNumStrings,
		PWSTR	pStrings,
		ULONG	dwDataSize,
		PVOID	pRawData
	)

Definition at line 1037 of file file.c.

{
    NTSTATUS Status;
    UNICODE_STRING SourceName, ComputerName;
    PEVENTLOGRECORD LogBuffer;
    LARGE_INTEGER SystemTime;
    ULONG Time;
    SIZE_T RecSize;
    DWORD dwComputerNameLength;
    WCHAR szComputerName[MAX_COMPUTERNAME_LENGTH + 1];
 
    if (!EventLogSource)
        return;
 
    RtlInitUnicodeString(&SourceName, EventLogSource->szName);
 
    dwComputerNameLength = ARRAYSIZE(szComputerName);
    if (!GetComputerNameW(szComputerName, &dwComputerNameLength))
        szComputerName[0] = L'\0';
 
    RtlInitUnicodeString(&ComputerName, szComputerName);
 
    NtQuerySystemTime(&SystemTime);
    RtlTimeToSecondsSince1970(&SystemTime, &Time);
 
    LogBuffer = LogfAllocAndBuildNewRecord(&RecSize,
                                           Time,
                                           wType,
                                           wCategory,
                                           dwEventId,
                                           &SourceName,
                                           &ComputerName,
                                           0,
                                           NULL,
                                           wNumStrings,
                                           pStrings,
                                           dwDataSize,
                                           pRawData);
    if (LogBuffer == NULL)
    {
        DPRINT1("LogfAllocAndBuildNewRecord failed!\n");
        return;
    }
 
    Status = LogfWriteRecord(EventLogSource->LogFile, LogBuffer, RecSize);
    if (!NT_SUCCESS(Status))
    {
        DPRINT1("ERROR writing to event log `%S' (Status 0x%08lx)\n",
                EventLogSource->LogFile->LogName, Status);
    }
 
    LogfFreeRecord(LogBuffer);
}

Referenced by ReportProductInfoEvent(), ServiceControlHandler(), and ServiceMain().

LogfWriteRecord()

NTSTATUS LogfWriteRecord	(	PLOGFILE	LogFile,
		PEVENTLOGRECORD	Record,
		SIZE_T	BufSize
	)

Definition at line 858 of file file.c.

{
    NTSTATUS Status;
    LARGE_INTEGER SystemTime;
 
    // ASSERT(sizeof(*Record) == sizeof(RecBuf));
 
    if (!Record || BufSize < sizeof(*Record))
        return STATUS_INVALID_PARAMETER;
 
    /* Lock the log file exclusive */
    RtlAcquireResourceExclusive(&LogFile->Lock, TRUE);
 
    /*
     * Retrieve the record written time now, that will also be compared
     * with the existing events timestamps in case the log is wrapping.
     */
    NtQuerySystemTime(&SystemTime);
    RtlTimeToSecondsSince1970(&SystemTime, &Record->TimeWritten);
 
    Status = ElfWriteRecord(&LogFile->LogFile, Record, BufSize);
    if (Status == STATUS_LOG_FILE_FULL)
    {
        /* The event log file is full, queue a message box for the user and exit */
        // TODO!
        DPRINT1("Log file `%S' is full!\n", LogFile->LogName);
    }
 
    /* Unlock the log file */
    RtlReleaseResource(&LogFile->Lock);
 
    return Status;
}

Referenced by ElfrIntReportEventW(), LogfReportEvent(), and ProcessPortMessage().

PortThreadRoutine()

NTSTATUS WINAPI PortThreadRoutine

(

PVOID

Param

)

Definition at line 27 of file logport.c.

{
    NTSTATUS Status = STATUS_SUCCESS;
 
    Status = InitLogPort();
    if (!NT_SUCCESS(Status))
        return Status;
 
    while (NT_SUCCESS(Status))
        Status = ProcessPortMessage();
 
    if (ConnectPortHandle != NULL)
        NtClose(ConnectPortHandle);
 
    if (MessagePortHandle != NULL)
        NtClose(MessagePortHandle);
 
    return Status;
}

Referenced by ServiceInit().

PRINT_RECORD()

VOID PRINT_RECORD

(

PEVENTLOGRECORD

pRec

)

Definition at line 544 of file eventlog.c.

{
    UINT i;
    PWSTR str;
    LARGE_INTEGER SystemTime;
    TIME_FIELDS Time;
 
    DPRINT1("PRINT_RECORD(0x%p)\n", pRec);
 
    DbgPrint("Length = %lu\n", pRec->Length);
    DbgPrint("Reserved = 0x%x\n", pRec->Reserved);
    DbgPrint("RecordNumber = %lu\n", pRec->RecordNumber);
 
    RtlSecondsSince1970ToTime(pRec->TimeGenerated, &SystemTime);
    RtlTimeToTimeFields(&SystemTime, &Time);
    DbgPrint("TimeGenerated = %hu.%hu.%hu %hu:%hu:%hu\n",
             Time.Day, Time.Month, Time.Year,
             Time.Hour, Time.Minute, Time.Second);
 
    RtlSecondsSince1970ToTime(pRec->TimeWritten, &SystemTime);
    RtlTimeToTimeFields(&SystemTime, &Time);
    DbgPrint("TimeWritten = %hu.%hu.%hu %hu:%hu:%hu\n",
             Time.Day, Time.Month, Time.Year,
             Time.Hour, Time.Minute, Time.Second);
 
    DbgPrint("EventID = %lu\n", pRec->EventID);
 
    switch (pRec->EventType)
    {
        case EVENTLOG_ERROR_TYPE:
            DbgPrint("EventType = EVENTLOG_ERROR_TYPE\n");
            break;
        case EVENTLOG_WARNING_TYPE:
            DbgPrint("EventType = EVENTLOG_WARNING_TYPE\n");
            break;
        case EVENTLOG_INFORMATION_TYPE:
            DbgPrint("EventType = EVENTLOG_INFORMATION_TYPE\n");
            break;
        case EVENTLOG_AUDIT_SUCCESS:
            DbgPrint("EventType = EVENTLOG_AUDIT_SUCCESS\n");
            break;
        case EVENTLOG_AUDIT_FAILURE:
            DbgPrint("EventType = EVENTLOG_AUDIT_FAILURE\n");
            break;
        default:
            DbgPrint("EventType = %hu\n", pRec->EventType);
    }
 
    DbgPrint("NumStrings = %hu\n", pRec->NumStrings);
    DbgPrint("EventCategory = %hu\n", pRec->EventCategory);
    DbgPrint("ReservedFlags = 0x%x\n", pRec->ReservedFlags);
    DbgPrint("ClosingRecordNumber = %lu\n", pRec->ClosingRecordNumber);
    DbgPrint("StringOffset = %lu\n", pRec->StringOffset);
    DbgPrint("UserSidLength = %lu\n", pRec->UserSidLength);
    DbgPrint("UserSidOffset = %lu\n", pRec->UserSidOffset);
    DbgPrint("DataLength = %lu\n", pRec->DataLength);
    DbgPrint("DataOffset = %lu\n", pRec->DataOffset);
 
    i = sizeof(EVENTLOGRECORD);
    DbgPrint("SourceName: %S\n", (PWSTR)((ULONG_PTR)pRec + i));
 
    i += (wcslen((PWSTR)((ULONG_PTR)pRec + i)) + 1) * sizeof(WCHAR);
    DbgPrint("ComputerName: %S\n", (PWSTR)((ULONG_PTR)pRec + i));
 
    if (pRec->StringOffset < pRec->Length && pRec->NumStrings)
    {
        DbgPrint("Strings:\n");
        str = (PWSTR)((ULONG_PTR)pRec + pRec->StringOffset);
        for (i = 0; i < pRec->NumStrings; i++)
        {
            DbgPrint("[%u] %S\n", i, str);
            str += wcslen(str) + 1;
        }
    }
 
    DbgPrint("Length2 = %lu\n", *(PULONG)((ULONG_PTR)pRec + pRec->Length - 4));
}

Referenced by ProcessPortMessage().

ProcessPortMessage()

NTSTATUS ProcessPortMessage

(

VOID

)

Definition at line 104 of file logport.c.

{
    NTSTATUS Status;
    PLOGFILE SystemLog = NULL;
    UCHAR Buffer[PORT_MAXIMUM_MESSAGE_LENGTH]; // IO_ERROR_LOG_MESSAGE_LENGTH
    PELF_API_MSG Message = (PELF_API_MSG)Buffer;
    PIO_ERROR_LOG_MESSAGE ErrorMessage;
    PEVENTLOGRECORD LogBuffer;
    SIZE_T RecSize;
    ULONG Time;
    USHORT EventType;
    UNICODE_STRING SourceName, ComputerName;
    DWORD dwComputerNameLength;
    WCHAR szComputerName[MAX_COMPUTERNAME_LENGTH + 1];
 
    DPRINT("ProcessPortMessage() called\n");
 
    SystemLog = LogfListItemByName(L"System");
 
    while (TRUE)
    {
        Status = NtReplyWaitReceivePort(MessagePortHandle,
                                        NULL,
                                        NULL,
                                        &Message->Header);
 
        if (!NT_SUCCESS(Status))
        {
            DPRINT1("NtReplyWaitReceivePort() failed (Status %lx)\n", Status);
            break;
        }
 
        DPRINT("Received message\n");
 
        if (Message->Header.u2.s2.Type == LPC_PORT_CLOSED)
        {
            DPRINT("Port closed\n");
            return STATUS_SUCCESS;
        }
 
        if (Message->Header.u2.s2.Type == LPC_REQUEST)
        {
            DPRINT("Received request\n");
        }
        else if (Message->Header.u2.s2.Type == LPC_DATAGRAM)
        {
            DPRINT("Received datagram (0x%x, 0x%x)\n",
                   Message->Unknown[0], Message->Unknown[1]);
            ErrorMessage = &Message->IoErrorMessage;
 
            // ASSERT(ErrorMessage->Type == IO_TYPE_ERROR_MESSAGE);
 
            RtlInitEmptyUnicodeString(&SourceName, NULL, 0);
            if (ErrorMessage->DriverNameLength > sizeof(UNICODE_NULL)) // DriverNameLength counts NULL-terminator
            {
                SourceName.Buffer = (PWSTR)((ULONG_PTR)ErrorMessage + ErrorMessage->DriverNameOffset);
                SourceName.MaximumLength = ErrorMessage->DriverNameLength;
                SourceName.Length = SourceName.MaximumLength - sizeof(UNICODE_NULL);
            }
 
            dwComputerNameLength = ARRAYSIZE(szComputerName);
            if (!GetComputerNameW(szComputerName, &dwComputerNameLength))
                szComputerName[0] = L'\0';
 
            RtlInitUnicodeString(&ComputerName, szComputerName);
 
            RtlTimeToSecondsSince1970(&ErrorMessage->TimeStamp, &Time);
 
            /* Set the event type based on the error code severity */
            EventType = (USHORT)(ErrorMessage->EntryData.ErrorCode >> 30);
            if (EventType == STATUS_SEVERITY_SUCCESS)
            {
                EventType = EVENTLOG_SUCCESS;
            }
            else if (EventType == STATUS_SEVERITY_INFORMATIONAL) // NT_INFORMATION
            {
                EventType = EVENTLOG_INFORMATION_TYPE;
            }
            else if (EventType == STATUS_SEVERITY_WARNING)       // NT_WARNING
            {
                EventType = EVENTLOG_WARNING_TYPE;
            }
            else if (EventType == STATUS_SEVERITY_ERROR)         // NT_ERROR
            {
                EventType = EVENTLOG_ERROR_TYPE;
            }
            else
            {
                /* Unknown severity, set to error */
                EventType = EVENTLOG_ERROR_TYPE;
            }
 
            /*
             * The data being saved consists of the IO_ERROR_LOG_PACKET structure
             * header, plus the additional raw data from the driver.
             */
            LogBuffer = LogfAllocAndBuildNewRecord(
                            &RecSize,
                            Time,
                            EventType,
                            ErrorMessage->EntryData.EventCategory,
                            ErrorMessage->EntryData.ErrorCode,
                            &SourceName,
                            &ComputerName,
                            0,
                            NULL,
                            ErrorMessage->EntryData.NumberOfStrings,
                            (PWSTR)((ULONG_PTR)ErrorMessage +
                                ErrorMessage->EntryData.StringOffset),
                            FIELD_OFFSET(IO_ERROR_LOG_PACKET, DumpData) +
                                ErrorMessage->EntryData.DumpDataSize,
                            (PVOID)&ErrorMessage->EntryData);
            if (LogBuffer == NULL)
            {
                DPRINT1("LogfAllocAndBuildNewRecord failed!\n");
                // return STATUS_NO_MEMORY;
                continue;
            }
 
            if (!onLiveCD && SystemLog)
            {
                Status = LogfWriteRecord(SystemLog, LogBuffer, RecSize);
                if (!NT_SUCCESS(Status))
                {
                    DPRINT1("ERROR writing to event log `%S' (Status 0x%08lx)\n",
                            SystemLog->LogName, Status);
                }
            }
            else
            {
                DPRINT1("\n--- EVENTLOG RECORD ---\n");
                PRINT_RECORD(LogBuffer);
                DPRINT1("\n");
            }
 
            LogfFreeRecord(LogBuffer);
        }
    }
 
    return Status;
}

Referenced by PortThreadRoutine().

RpcThreadRoutine()

DWORD WINAPI RpcThreadRoutine

(

LPVOID

lpParameter

)

Definition at line 20 of file rpcserver.c.

{
    RPC_STATUS Status;
 
    Status = RpcServerUseProtseqEpW(L"ncacn_np", 20, L"\\pipe\\browser", NULL);
    if (Status != RPC_S_OK)
    {
        ERR("RpcServerUseProtseqEpW() failed (Status %lx)\n", Status);
        return 0;
    }
 
    Status = RpcServerRegisterIf(browser_v0_0_s_ifspec, NULL, NULL);
    if (Status != RPC_S_OK)
    {
        ERR("RpcServerRegisterIf() failed (Status %lx)\n", Status);
        return 0;
    }
 
    Status = RpcServerListen(1, RPC_C_LISTEN_MAX_CALLS_DEFAULT, FALSE);
    if (Status != RPC_S_OK)
    {
        ERR("RpcServerListen() failed (Status %lx)\n", Status);
    }
 
    return 0;
}

Variable Documentation

EventLogSource

PEVENTSOURCE EventLogSource

extern

Definition at line 35 of file eventlog.c.

Referenced by CheckLogOrSourceExistence(), InstallEventSource(), LogfReportEvent(), and wmain().